@jinn-network/core 0.1.0 → 0.1.1-canary.7b188db5

package/dist/scrub/pii-build.js

@@ -1,4 +1,4 @@
-import { TransformersPiiDetector, } from './transformers-detector.js';
+import { GlinerPiiDetector, DEFAULT_GLINER_MODEL, } from './gliner-detector.js';
 /** Thrown by the fail-closed detector on every scrub call when ML PII was enabled but the model never loaded. */
 export class MlPiiUnavailableError extends Error {
     constructor(cause) {
@@ -24,17 +24,17 @@ function failClosedDetector(cause) {
     };
 }
 /**
- * Builds the ML PII detector (Transformers.js NER, in-process) when enabled,
- * warming up the model.
+ * Builds the ML PII detector (GLiNER ONNX, in-process) when enabled, warming
+ * up the model. Default factory is {@link GlinerPiiDetector}; tests inject a
+ * mock factory so CI never hits the network.
  *
  * Failure altitude is **publish-time, not boot-time** (per
  * `spec/2026-06-15-ts-trajectory-scrub-stack.md`, §"Failure posture": "if any
  * stage errors or the model fails to load, the trajectory is **not**
  * published"). Three cases:
  *
- * - Disabled (the default): returns `undefined` — the scrub pipeline runs the
- *   structural key policy + openredaction + secretlint/entropy stages only, with
- *   no ML PII tier and no error. Exactly the legacy behaviour.
+ * - Disabled (`enabled: false`): returns `undefined` — deterministic inventory
+ *   only, no ML PII tier and no error.
  * - Enabled and the model loads: returns the real detector.
  * - Enabled but the model fails to load: does NOT throw at construction. Returns
  *   a fail-closed detector that hard-throws on every scrub call, so each affected
@@ -45,15 +45,15 @@ function failClosedDetector(cause) {
  */
 export async function maybeBuildPiiDetector(cfg, log = (m) => console.warn(m), factory = {
     create(options) {
-        return new TransformersPiiDetector(options);
+        return new GlinerPiiDetector(options);
     },
 }) {
     if (!cfg.enabled)
         return undefined;
     try {
-        const detector = factory.create(cfg.model ? { model: cfg.model } : {});
+        const detector = factory.create(cfg.model ? { model: cfg.model } : { model: DEFAULT_GLINER_MODEL });
         await detector.init();
-        log('[scrub] ML PII detection (Transformers.js NER) enabled.');
+        log(`[scrub] ML PII detection (GLiNER ONNX, model=${cfg.model ?? DEFAULT_GLINER_MODEL}) enabled.`);
         return detector;
     }
     catch (err) {

package/dist/scrub/pipeline.d.ts

@@ -1,38 +1,77 @@
+import { assertNoRejectPublish, shouldRejectPublish } from './apply-dispositions.js';
+import type { Detector } from './finding.js';
+import { type PolicyTable } from './policy.js';
+import { type PolicyHashInput } from './provenance.js';
+import { type ReviewQueueStore } from './review-queue.js';
 import type { Attributes, ScrubResult, ScrubStage } from './types.js';
+export { shouldRejectPublish, assertNoRejectPublish };
+export interface ScrubPipelineOptions {
+    policy?: PolicyTable;
+    /** Check-mode: any non-pass disposition rejects (design §6.5). */
+    checkMode?: boolean;
+    /**
+     * Review-queue store for flag resolutions (#1973). Defaults to the
+     * operator-local `~/.jinn-client/scrub-review/queue.jsonl` store in
+     * redact-mode. Pass an in-memory store in tests.
+     */
+    reviewStore?: ReviewQueueStore;
+    /**
+     * When true (default in redact-mode), unresolved flags enqueue + throw
+     * {@link UnresolvedFlagError}. Check-mode leaves this off.
+     */
+    failClosedOnUnresolvedFlags?: boolean;
+    /**
+     * Inputs for the published policy hash (#1974). When omitted, emit helpers
+     * still bump `schemaVersion` but leave `policyHash` unset.
+     */
+    provenance?: Omit<PolicyHashInput, 'policy' | 'detectors'>;
+}
 /**
- * Runs scrub stages in order over a span's attributes: each stage's output
- * attributes feed the next, and redaction records accumulate across the whole
- * chain. Stages may be async (e.g. the ML PII stage). The `components` list
- * (stage name + pinned version) is available for local inspection and tests;
- * the current trace-envelope schema does not publish it.
+ * Runs one detector inventory, then one disposition pass (#1969).
+ *
+ * Nested values (#1378): after the flat detect→dispose pass, surviving
+ * object/array values are walked and every string leaf is scrubbed through
+ * the same detect→dispose path, keyed by the TOP-LEVEL attribute key.
  *
- * Nested values (#1378): the stages themselves operate on flat string values —
- * a non-string attribute value (e.g. `tool.args` captured as an object) used
- * to pass through every stage untouched and publish verbatim, leaking the
- * exact strings the same pipeline redacted out of `tool.result`. `run()` now
- * walks surviving object/array values after the flat pass and scrubs every
- * string leaf through the same stage chain, keyed by the TOP-LEVEL attribute
- * key so the key policy classifies leaves exactly like the flat value
- * (`jinn.*` structural attributes stay raw; `drop` keys are already gone
- * before the walk). Redactions from leaf runs carry the top-level key, so the
- * redaction manifest and capture redaction diff report `tool.args` as the
- * touched field.
+ * Constructor also accepts legacy {@link ScrubStage} arrays (stage.scrub chain)
+ * so existing unit tests and injectors keep working through the migration.
  */
 export declare class ScrubPipeline {
+    private readonly policy;
+    private readonly checkMode;
+    private readonly detectors;
     private readonly stages;
-    constructor(stages: ScrubStage[]);
+    private readonly reviewStore;
+    private readonly failClosedOnUnresolvedFlags;
+    private readonly provenanceExtras;
+    constructor(detectorsOrStages: Array<Detector | ScrubStage>, opts?: ScrubPipelineOptions);
     get components(): Array<{
         name: string;
         version: string;
     }>;
-    run(attributes: Attributes): Promise<ScrubResult>;
-    /** One pass of every stage over a flat attribute bag (the original `run`). */
-    private runStages;
+    /** Disposition policy table used by this pipeline (#1974). */
+    get policyTable(): PolicyTable;
     /**
-     * Recursively scrub the string leaves of a nested attribute value through
-     * the full stage chain, using the top-level attribute key for policy
-     * classification. Non-container, non-string values (numbers, booleans,
-     * null) and non-plain objects pass through unchanged.
+     * Additive provenance fields for a redaction manifest (#1974). Always
+     * includes `schemaVersion`; `policyHash` is present when provenance
+     * extras were supplied at construction.
      */
+    manifestProvenance(perClassCounts?: Record<string, number>): {
+        schemaVersion: number;
+        policyHash?: string;
+        perClassCounts?: Record<string, number>;
+    };
+    /**
+     * Reproducible policy hash, or undefined when provenance inputs were not
+     * configured (legacy stage-only pipelines).
+     */
+    policyHash(): string | undefined;
+    run(attributes: Attributes): Promise<ScrubResult>;
+    private assertAndEnqueueUnresolvedFlags;
+    /** Legacy ScrubStage chain (tests / residual injectors). */
+    private runLegacyStages;
+    private runStagesFlat;
+    private scrubNestedLegacy;
+    private runDetectDispose;
     private scrubNested;
 }

package/dist/scrub/pipeline.js

@@ -1,43 +1,153 @@
+import { applyDispositions, assertNoRejectPublish, shouldRejectPublish } from './apply-dispositions.js';
+import { DEFAULT_POLICY } from './policy.js';
+import { REDACTION_MANIFEST_SCHEMA_VERSION, computePolicyHash, mergePerClassCounts, } from './provenance.js';
+import { UnresolvedFlagError, createReviewQueueStore, } from './review-queue.js';
+export { shouldRejectPublish, assertNoRejectPublish };
+function isDetector(item) {
+    return typeof item.detect === 'function';
+}
 /**
- * Runs scrub stages in order over a span's attributes: each stage's output
- * attributes feed the next, and redaction records accumulate across the whole
- * chain. Stages may be async (e.g. the ML PII stage). The `components` list
- * (stage name + pinned version) is available for local inspection and tests;
- * the current trace-envelope schema does not publish it.
+ * Runs one detector inventory, then one disposition pass (#1969).
+ *
+ * Nested values (#1378): after the flat detect→dispose pass, surviving
+ * object/array values are walked and every string leaf is scrubbed through
+ * the same detect→dispose path, keyed by the TOP-LEVEL attribute key.
  *
- * Nested values (#1378): the stages themselves operate on flat string values —
- * a non-string attribute value (e.g. `tool.args` captured as an object) used
- * to pass through every stage untouched and publish verbatim, leaking the
- * exact strings the same pipeline redacted out of `tool.result`. `run()` now
- * walks surviving object/array values after the flat pass and scrubs every
- * string leaf through the same stage chain, keyed by the TOP-LEVEL attribute
- * key so the key policy classifies leaves exactly like the flat value
- * (`jinn.*` structural attributes stay raw; `drop` keys are already gone
- * before the walk). Redactions from leaf runs carry the top-level key, so the
- * redaction manifest and capture redaction diff report `tool.args` as the
- * touched field.
+ * Constructor also accepts legacy {@link ScrubStage} arrays (stage.scrub chain)
+ * so existing unit tests and injectors keep working through the migration.
  */
 export class ScrubPipeline {
+    policy;
+    checkMode;
+    detectors;
     stages;
-    constructor(stages) {
-        this.stages = stages;
+    reviewStore;
+    failClosedOnUnresolvedFlags;
+    provenanceExtras;
+    constructor(detectorsOrStages, opts = {}) {
+        this.policy = opts.policy ?? DEFAULT_POLICY;
+        this.checkMode = opts.checkMode ?? false;
+        this.reviewStore = opts.reviewStore;
+        this.failClosedOnUnresolvedFlags =
+            opts.failClosedOnUnresolvedFlags ?? !this.checkMode;
+        this.provenanceExtras = opts.provenance;
+        if (detectorsOrStages.length > 0 && detectorsOrStages.every(isDetector)) {
+            this.detectors = detectorsOrStages;
+            this.stages = null;
+        }
+        else {
+            this.detectors = null;
+            this.stages = detectorsOrStages;
+        }
     }
     get components() {
-        return this.stages.map((s) => ({ name: s.name, version: s.version }));
+        const items = this.detectors ?? this.stages ?? [];
+        return items.map((d) => ({ name: d.name, version: d.version }));
+    }
+    /** Disposition policy table used by this pipeline (#1974). */
+    get policyTable() {
+        return this.policy;
+    }
+    /**
+     * Additive provenance fields for a redaction manifest (#1974). Always
+     * includes `schemaVersion`; `policyHash` is present when provenance
+     * extras were supplied at construction.
+     */
+    manifestProvenance(perClassCounts) {
+        const out = { schemaVersion: REDACTION_MANIFEST_SCHEMA_VERSION };
+        const hash = this.policyHash();
+        if (hash)
+            out.policyHash = hash;
+        if (perClassCounts && Object.keys(perClassCounts).length > 0) {
+            out.perClassCounts = perClassCounts;
+        }
+        return out;
+    }
+    /**
+     * Reproducible policy hash, or undefined when provenance inputs were not
+     * configured (legacy stage-only pipelines).
+     */
+    policyHash() {
+        if (!this.provenanceExtras)
+            return undefined;
+        return computePolicyHash({
+            policy: this.policy,
+            detectors: this.components,
+            modelId: this.provenanceExtras.modelId,
+            labels: this.provenanceExtras.labels,
+            allowlistDigest: this.provenanceExtras.allowlistDigest,
+        });
     }
     async run(attributes) {
-        const flat = await this.runStages(attributes);
+        if (this.stages) {
+            return this.runLegacyStages(attributes);
+        }
+        const flat = await this.runDetectDispose(attributes);
         const out = {};
         const redactions = [...flat.redactions];
+        const findings = [...flat.findings];
+        const unresolvedFlags = [...flat.unresolvedFlags];
+        let perClassCounts = { ...flat.perClassCounts };
+        let rejected = flat.rejected;
         for (const [key, value] of Object.entries(flat.attributes)) {
-            // Flat strings were scrubbed by the pass above; only container values
-            // (objects/arrays) still hold unscrubbed string leaves.
-            out[key] = typeof value === 'string' ? value : await this.scrubNested(key, value, redactions);
+            out[key] =
+                typeof value === 'string'
+                    ? value
+                    : await this.scrubNested(key, value, redactions, findings, unresolvedFlags, (nestedCounts) => {
+                        perClassCounts =
+                            mergePerClassCounts(perClassCounts, nestedCounts) ?? perClassCounts;
+                    });
+        }
+        // Check-mode: trust the disposition `rejected` bit. Do not re-derive from
+        // raw redactions.length — allowlist-pass records are auditable passes.
+        if (this.checkMode && flat.rejected)
+            rejected = true;
+        const result = {
+            attributes: out,
+            redactions,
+            findings,
+            rejected,
+            unresolvedFlags,
+            perClassCounts,
+        };
+        // Publish altitude: reject-publish classes abort loudly with a class name.
+        // Check-mode distill maps redactions → rejection reasons without throwing.
+        if (!this.checkMode)
+            assertNoRejectPublish(result, this.policy);
+        if (!this.checkMode && this.failClosedOnUnresolvedFlags) {
+            this.assertAndEnqueueUnresolvedFlags(result.unresolvedFlags ?? [], attributes);
+        }
+        return result;
+    }
+    assertAndEnqueueUnresolvedFlags(unresolved, attributes) {
+        if (unresolved.length === 0)
+            return;
+        // Lazy default: operator-local queue so unattended publishes leave a
+        // reviewable trail. Tests inject `reviewStore` (memory) or disable
+        // fail-closed via `failClosedOnUnresolvedFlags: false`.
+        const store = this.reviewStore ?? createReviewQueueStore();
+        const enqueued = store.enqueue(unresolved.map((finding) => {
+            const value = attributes[finding.span.key];
+            const text = typeof value === 'string' ? value : '';
+            const snippet = text.slice(Math.max(0, finding.span.start - 40), Math.min(text.length, finding.span.end + 40));
+            return {
+                finding,
+                context: { attributeKey: finding.span.key, snippet },
+            };
+        }));
+        throw new UnresolvedFlagError(unresolved, enqueued.map((e) => e.id));
+    }
+    /** Legacy ScrubStage chain (tests / residual injectors). */
+    async runLegacyStages(attributes) {
+        const flat = await this.runStagesFlat(attributes);
+        const out = {};
+        const redactions = [...flat.redactions];
+        for (const [key, value] of Object.entries(flat.attributes)) {
+            out[key] = typeof value === 'string' ? value : await this.scrubNestedLegacy(key, value, redactions);
         }
         return { attributes: out, redactions };
     }
-    /** One pass of every stage over a flat attribute bag (the original `run`). */
-    async runStages(attributes) {
+    async runStagesFlat(attributes) {
         let current = attributes;
         const redactions = [];
         for (const stage of this.stages) {
@@ -47,34 +157,66 @@ export class ScrubPipeline {
         }
         return { attributes: current, redactions };
     }
-    /**
-     * Recursively scrub the string leaves of a nested attribute value through
-     * the full stage chain, using the top-level attribute key for policy
-     * classification. Non-container, non-string values (numbers, booleans,
-     * null) and non-plain objects pass through unchanged.
-     */
-    async scrubNested(key, value, redactions) {
+    async scrubNestedLegacy(key, value, redactions) {
         if (typeof value === 'string') {
-            const result = await this.runStages({ [key]: value });
+            const result = await this.runStagesFlat({ [key]: value });
             redactions.push(...result.redactions);
             const scrubbed = result.attributes[key];
-            // Stages only rewrite strings; a `drop`-classified key never reaches
-            // here (dropped in the flat pass), so non-string means untouched.
             return typeof scrubbed === 'string' ? scrubbed : value;
         }
         if (Array.isArray(value)) {
             const items = [];
             for (const item of value)
-                items.push(await this.scrubNested(key, item, redactions));
+                items.push(await this.scrubNestedLegacy(key, item, redactions));
+            return items;
+        }
+        if (value !== null && typeof value === 'object') {
+            const proto = Object.getPrototypeOf(value);
+            if (proto !== Object.prototype && proto !== null)
+                return value;
+            const entries = {};
+            for (const [k, v] of Object.entries(value)) {
+                entries[k] = await this.scrubNestedLegacy(key, v, redactions);
+            }
+            return entries;
+        }
+        return value;
+    }
+    async runDetectDispose(attributes) {
+        const findings = [];
+        for (const detector of this.detectors) {
+            findings.push(...(await detector.detect(attributes)));
+        }
+        return applyDispositions(attributes, findings, {
+            policy: this.policy,
+            checkMode: this.checkMode,
+            reviewStore: this.reviewStore,
+        });
+    }
+    async scrubNested(key, value, redactions, findings, unresolvedFlags, onCounts) {
+        if (typeof value === 'string') {
+            const result = await this.runDetectDispose({ [key]: value });
+            redactions.push(...result.redactions);
+            findings.push(...result.findings);
+            unresolvedFlags.push(...result.unresolvedFlags);
+            onCounts(result.perClassCounts);
+            const scrubbed = result.attributes[key];
+            return typeof scrubbed === 'string' ? scrubbed : value;
+        }
+        if (Array.isArray(value)) {
+            const items = [];
+            for (const item of value) {
+                items.push(await this.scrubNested(key, item, redactions, findings, unresolvedFlags, onCounts));
+            }
             return items;
         }
         if (value !== null && typeof value === 'object') {
             const proto = Object.getPrototypeOf(value);
             if (proto !== Object.prototype && proto !== null)
-                return value; // non-plain: pass through
+                return value;
             const entries = {};
             for (const [k, v] of Object.entries(value)) {
-                entries[k] = await this.scrubNested(key, v, redactions);
+                entries[k] = await this.scrubNested(key, v, redactions, findings, unresolvedFlags, onCounts);
             }
             return entries;
         }

package/dist/scrub/plain-patterns-stage.d.ts

@@ -1,31 +1,33 @@
 /**
- * plain-patterns stage — deterministic regex redaction for two shapes the
- * probabilistic stages demonstrably miss (issue #1330, found while building
- * the harness-layer capture path in #1310):
+ * plain-patterns detector — deterministic regex findings for shapes the
+ * probabilistic detectors miss (#1330 / #1415 / #1959 / #1969):
  *
- *  - plain email addresses: openredaction's EMAIL pattern is unreliable
- *    (misses e.g. `jane.doe@example-corp.com`);
- *  - POSIX home-directory paths carrying a username
- *    (`/Users/<name>/…`, `/home/<name>/…`) — nothing else touches paths.
+ *  - email (B1)
+ *  - POSIX home-directory paths (D1)
+ *  - AWS/GCP credential-ID prefixes (A1)
+ *  - Ethereum-style wallet addresses `0x`+40 hex (C1)
  *
- * Graduated here from the harness-layer's capture-local stages so the daemon
- * capture publish path and the harness layer share ONE implementation.
- * Deliberately broad: over-redacting an email or a username is cheap; leaking
- * one is not.
- *
- * An opt-in third set (`credentialIds`, #1415) adds deterministic cloud
- * credential-ID prefixes for the seed profile, which runs without the entropy
- * fallback that covers these shapes in the trace profile.
+ * Emits findings only — disposition owns stubs. Wallet + credential-ID shapes
+ * are always registered in the shared inventory (#1969); policy decides.
  */
 import { type KeyPolicy } from './key-policy.js';
+import type { Detector } from './finding.js';
 import type { ScrubStage } from './types.js';
 export interface PlainPatternsOptions {
     /**
-     * Adds the deterministic credential-ID prefixes above (#1415). Default false:
-     * the trace profile already catches these via secretlint's entropy fallback
-     * and must stay byte-identical. The seed profile (which runs without the
-     * fallback) turns this on.
+     * @deprecated (#1969) Credential IDs are always in the shared inventory.
+     * Kept so call sites that pass `{ credentialIds: true }` still type-check.
      */
     credentialIds?: boolean;
+    /**
+     * @deprecated (#1969) Wallet addresses are always in the shared inventory.
+     * Kept so call sites that pass `{ walletAddresses: true }` still type-check.
+     */
+    walletAddresses?: boolean;
 }
+export declare function plainPatternsDetector(policy: KeyPolicy, _opts?: PlainPatternsOptions): Detector;
+/**
+ * Legacy ScrubStage wrapper: detect + apply default dispositions. New callers
+ * should use {@link plainPatternsDetector} via ScrubPipeline.
+ */
 export declare function plainPatternsStage(policy: KeyPolicy, opts?: PlainPatternsOptions): ScrubStage;

package/dist/scrub/plain-patterns-stage.js

@@ -1,36 +1,25 @@
 /**
- * plain-patterns stage — deterministic regex redaction for two shapes the
- * probabilistic stages demonstrably miss (issue #1330, found while building
- * the harness-layer capture path in #1310):
+ * plain-patterns detector — deterministic regex findings for shapes the
+ * probabilistic detectors miss (#1330 / #1415 / #1959 / #1969):
  *
- *  - plain email addresses: openredaction's EMAIL pattern is unreliable
- *    (misses e.g. `jane.doe@example-corp.com`);
- *  - POSIX home-directory paths carrying a username
- *    (`/Users/<name>/…`, `/home/<name>/…`) — nothing else touches paths.
+ *  - email (B1)
+ *  - POSIX home-directory paths (D1)
+ *  - AWS/GCP credential-ID prefixes (A1)
+ *  - Ethereum-style wallet addresses `0x`+40 hex (C1)
  *
- * Graduated here from the harness-layer's capture-local stages so the daemon
- * capture publish path and the harness layer share ONE implementation.
- * Deliberately broad: over-redacting an email or a username is cheap; leaking
- * one is not.
- *
- * An opt-in third set (`credentialIds`, #1415) adds deterministic cloud
- * credential-ID prefixes for the seed profile, which runs without the entropy
- * fallback that covers these shapes in the trace profile.
+ * Emits findings only — disposition owns stubs. Wallet + credential-ID shapes
+ * are always registered in the shared inventory (#1969); policy decides.
  */
+import { applyDispositions } from './apply-dispositions.js';
 import { classifyKey } from './key-policy.js';
-const VERSION = '0.1.0';
+const VERSION = '0.2.0';
 /** Plain email shape. */
 const EMAIL_PATTERN = /[A-Za-z0-9._%+-]+@[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])+)+/g;
 /** POSIX home-dir path segment carrying a username. */
 const HOME_PATH_PATTERN = /\/(?:Users|home)\/[^/\s"'`]+/g;
-const PATTERNS = [
-    { pattern: EMAIL_PATTERN, replacement: '[EMAIL]', detail: 'email', kind: 'pii' },
-    { pattern: HOME_PATH_PATTERN, replacement: '/users/anon', detail: 'home-path', kind: 'pii' },
-];
 /**
  * Bare AWS access-key ID — the fixed four-char prefixes + 16 key chars that
- * secretlint's aws rule only scans for under `enableIDScanRule: true`, which
- * preset-recommend leaves off (#1415).
+ * secretlint's aws rule only scans for under `enableIDScanRule: true`.
  */
 const AWS_KEY_ID_PATTERN = /\b(?:A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}\b/g;
 /**
@@ -38,47 +27,62 @@ const AWS_KEY_ID_PATTERN = /\b(?:A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|
  * charset includes `-`, which breaks word-boundary semantics at the end.
  */
 const GCP_API_KEY_PATTERN = /\bAIza[0-9A-Za-z_-]{35}/g;
-const CREDENTIAL_ID_PATTERNS = [
-    {
-        pattern: AWS_KEY_ID_PATTERN,
-        replacement: '[SECRET:aws-access-key-id]',
-        detail: 'aws-access-key-id',
-        kind: 'secret',
-    },
-    {
-        pattern: GCP_API_KEY_PATTERN,
-        replacement: '[SECRET:gcp-api-key]',
-        detail: 'gcp-api-key',
-        kind: 'secret',
-    },
+/**
+ * Ethereum-style wallet address: `0x` + exactly 40 hex chars (#1959 / C1).
+ * Bare 40-hex git SHAs and `0x`+64 tx hashes must survive.
+ */
+const ETH_ADDRESS_PATTERN = /\b0x[a-fA-F0-9]{40}\b/g;
+const RULES = [
+    { pattern: EMAIL_PATTERN, class: 'B1', evidence: 'email' },
+    { pattern: HOME_PATH_PATTERN, class: 'D1', evidence: 'home-path' },
+    { pattern: AWS_KEY_ID_PATTERN, class: 'A1', evidence: 'aws-access-key-id' },
+    { pattern: GCP_API_KEY_PATTERN, class: 'A1', evidence: 'gcp-api-key' },
+    { pattern: ETH_ADDRESS_PATTERN, class: 'C1', evidence: 'eth-address' },
 ];
-export function plainPatternsStage(policy, opts = {}) {
-    const patterns = opts.credentialIds ? [...PATTERNS, ...CREDENTIAL_ID_PATTERNS] : PATTERNS;
+function collectMatches(text, key, rule, detector) {
+    const findings = [];
+    const re = new RegExp(rule.pattern.source, rule.pattern.flags.includes('g') ? rule.pattern.flags : `${rule.pattern.flags}g`);
+    let match;
+    while ((match = re.exec(text)) !== null) {
+        findings.push({
+            class: rule.class,
+            span: { key, start: match.index, end: match.index + match[0].length },
+            confidence: 'VERY_HIGH',
+            evidence: [rule.evidence],
+            detector,
+        });
+    }
+    return findings;
+}
+export function plainPatternsDetector(policy, _opts = {}) {
+    const meta = { name: 'plain-patterns', version: VERSION };
     return {
-        name: 'plain-patterns',
-        version: VERSION,
-        scrub(attributes) {
-            const out = {};
-            const redactions = [];
+        ...meta,
+        detect(attributes) {
+            const findings = [];
             for (const [key, value] of Object.entries(attributes)) {
-                if (typeof value !== 'string' || classifyKey(key, policy) !== 'content') {
-                    out[key] = value;
+                if (typeof value !== 'string' || classifyKey(key, policy) !== 'content')
                     continue;
+                for (const rule of RULES) {
+                    findings.push(...collectMatches(value, key, rule, meta));
                 }
-                let scrubbed = value;
-                for (const { pattern, replacement, detail, kind } of patterns) {
-                    let hits = 0;
-                    scrubbed = scrubbed.replace(pattern, () => {
-                        hits += 1;
-                        return replacement;
-                    });
-                    for (let i = 0; i < hits; i += 1) {
-                        redactions.push({ key, stage: 'plain-patterns', kind, detail });
-                    }
-                }
-                out[key] = scrubbed;
             }
-            return { attributes: out, redactions };
+            return findings;
+        },
+    };
+}
+/**
+ * Legacy ScrubStage wrapper: detect + apply default dispositions. New callers
+ * should use {@link plainPatternsDetector} via ScrubPipeline.
+ */
+export function plainPatternsStage(policy, opts = {}) {
+    const detector = plainPatternsDetector(policy, opts);
+    return {
+        name: detector.name,
+        version: detector.version,
+        scrub(attributes) {
+            const findings = detector.detect(attributes);
+            return applyDispositions(attributes, findings);
         },
     };
 }

package/dist/scrub/policy.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Versioned disposition policy (#1969 / design §6.5).
+ *
+ * disposition(class, band) -> redact | reject-publish | flag | pass
+ *
+ * Defaults follow §3.2's rightmost columns. C2 stays `pass` until the flag
+ * review surface exists (do not redact 0x+64 tx hashes).
+ */
+import type { Band, Finding, ScrubClass } from './finding.js';
+export type Disposition = 'redact' | 'reject-publish' | 'flag' | 'pass';
+export declare const POLICY_VERSION = "1.0.0";
+/** Per-band dispositions for one class. Missing bands fall back to `pass`. */
+export type ClassDispositionRow = Partial<Record<Band, Disposition>>;
+export interface PolicyTable {
+    version: string;
+    dispositions: Partial<Record<ScrubClass, ClassDispositionRow>>;
+}
+/**
+ * Default policy. High-confidence deterministic classes redact; reject classes
+ * (A4/A5) reject-publish; A2 mid-band flags; C2 passes pending flag surface.
+ */
+export declare const DEFAULT_POLICY: PolicyTable;
+export declare function resolveDisposition(scrubClass: ScrubClass, band: Band, policy?: PolicyTable): Disposition;
+/**
+ * Check-mode mapping (design §6.5): any non-`pass` disposition → reject.
+ * One mapping line — not a second pipeline.
+ */
+export declare function checkModeRejects(findings: Finding[], policy?: PolicyTable): boolean;